Arbitrum Council Empties Binance Hack Wallet Without the Key

Arbitrum's Security Council doesn't need your private key. It proved that again on Oct. 30, when it pulled 74,559,805.2 ARB and roughly 8,426 ETH out of an address tied to the Binance exploit — without ever holding the key to it.

The mechanics came out Nov. 2 in a walkthrough Zealynx posted on the Ethereum Magicians forum. At 8:08 a.m. Hong Kong time, the council's Safe — currently needing nine of its 12 signers — called Arbitrum's UpgradeExecutor in a single Ethereum transaction, block 26301886, according to the post. For a moment the executor ran override code on the Inbox that logged the target address, unaliased, as the message's sender, then swapped the original code back in. It did the same for each asset, ARB first, ETH second.

Unchained's own read of Ethereum and Arbitrum One chain data lines up. Both messages landed on Arbitrum One nine minutes and 45 seconds later as type 0x65 transactions with blank signature fields, using the address's nonces 2 and 3. The first shipped the ARB to a holding address ending in 0DA0; the second sent 8,425.99768 ETH to the same place. Nothing in the token logs gives the game away — the ARB contract and indexers just see a normal transfer the holder appears to have made. What gives it up on Arbitrum One is the transaction type and that empty signature.

This isn't a first. The council did the same thing in April, moving more than 30,765 ETH held by the KelpDAO exploiter on Arbitrum One, per its notice at the time. Offchain Labs co-founder and CEO Steven Goldfeder told Unchained's Uneasy Money in July that the setup is intentional: the power sits with an external, broadly elected entity, and he said it wasn't him holding that lever.

The council's notice says the frozen funds can only be moved by an ArbitrumDAO governance vote coordinated with relevant parties, and that no other user's funds or applications were touched. The freeze dropped hours after Binance's hot wallets were drained in a loss the exchange pegs at about $6.3 billion.

Zealynx isn't crying foul. It wrote that it sees no bug — the council used powers the DAO handed it and published both actions within 90 minutes. The real takeaway is for builders: when a spec promises only a key can move a wallet, on these chains that promise holds only for whoever controls the upgrade path, which on Arbitrum One means the council's emergency Safe plus the DAO's timelock on Ethereum.